求助: ssh 远程无法登陆提示: Permission denied, please try again

2021-06-04 16:23:54 +08:00
 qping

使用密钥登陆是可以的,但是在别的机器上使用密码登陆就不行了。服务器系统版本是 Centos 7.8.2003.

尝试过以下的步骤:

  1. 当 ssh 上服务器后,su - root 输入密码是可以的,排除密码错误的问题
  2. /etc/ssh/sshd_config 里面的 # PermitRootLogin yes 的 # 去掉并重启 systemctl restart sshd,还是不行
  3. /etc/ssh/sshd_config 里面的 PasswordAuthentication 值原来就是 yes
  4. setenforce 0 也不行
  5. 尝试查看安全日志 :/var/log/secure 发现不管是登陆成功还是失败,在里面都没有生成新的日志
  6. 查看 /etc/hosts.allow 和 /etc/hosts.deny 里面都没有配置东西
  7. 查看登陆日志:执行 last 命令发现有个 roo 用户(我没有打错,就是少一个 t),是不是有可能被攻击了?
root     pts/1        170.3.69.2       Fri Jun  4 15:49   still logged in
root     pts/1        170.3.69.2       Fri Jun  4 15:47 - 15:49  (00:01)
root     pts/1        170.3.69.2       Fri Jun  4 15:46 - 15:47  (00:00)

...省略一些差不多的 ...

roo      pts/0        :0               Wed Mar 24 12:23 - 12:24  (00:01)
roo      pts/0        :0               Wed Mar 24 12:16 - 12:23  (00:07)
roo      :0           :0               Wed Mar 24 12:10 - down   (00:14)
reboot   system boot  3.10.0-1127.el7. Wed Mar 24 12:00 - 12:24  (00:24)

既然使用密钥可以登陆的话,那网络问题应该排除了。实在没有办法了,有没有大佬能帮忙鉴定下问题出现在哪里?

这个是使用密钥成功能登陆的日志( ssh -v -p 22 <ip 地址>):

OpenSSH_7.4p1, OpenSSL 1.0.2k-fips  26 Jan 2017
debug1: Reading configuration data /root/.ssh/config
debug1: /root/.ssh/config line 40: Applying options for *
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 58: Applying options for *
debug1: auto-mux: Trying existing master
debug1: mux_client_request_session: master session id: 2
Last login: Fri Jun  4 15:59:42 2021

这个是在别的电脑上使用密码登陆失败的日志( ssh -v -p 22 <ip 地址>):

OpenSSH_7.4p1, OpenSSL 1.0.2k-fips  26 Jan 2017
debug1: Reading configuration data /root/.ssh/config
debug1: /root/.ssh/config line 1: Applying options for *
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 58: Applying options for *
debug1: auto-mux: Trying existing master
debug1: Control socket "/root/.ssh/<这里是 ip>-22-root" does not exist
debug1: Connecting to <这里是 ip> [<这里是 ip>] port 22.
debug1: Connection established.
debug1: permanently_set_uid: 0/0
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/<这里是 key 名称>.key type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/<这里是 key 名称>.key-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.4
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.6.1
debug1: match: OpenSSH_6.6.1 pat OpenSSH_6.6.1* compat 0x04000000
debug1: Authenticating to <这里是 ip>:22 as 'root'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256@libssh.org
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: curve25519-sha256@libssh.org need=64 dh_need=64
debug1: kex: curve25519-sha256@libssh.org need=64 dh_need=64
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:sQeFN1/GfQqAohAXEyndzeCStwG4wEcawUl3vZhwniw
debug1: Host '<这里是 ip>' is known and matches the ECDSA host key.
debug1: Found key in /root/.ssh/known_hosts:23
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug1: Next authentication method: gssapi-keyex
debug1: No valid Key exchange context
debug1: Next authentication method: gssapi-with-mic
debug1: Unspecified GSS failure.  Minor code may provide more information
No Kerberos credentials available (default cache: KEYRING:persistent:0)

debug1: Unspecified GSS failure.  Minor code may provide more information
No Kerberos credentials available (default cache: KEYRING:persistent:0)

debug1: Next authentication method: publickey
debug1: Trying private key: /root/.ssh/<这里是 key 名称>.key
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug1: Next authentication method: password
root@<这里是 ip>'s password:
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
Permission denied, please try again.
root@<这里是 ip>'s password:
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
Permission denied, please try again.
root@<这里是 ip>'s password:
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug1: No more authentication methods to try.
Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password)
1708 次点击
所在节点    CentOS
7 条回复
napsterwu
2021-06-04 17:02:02 +08:00
1. 用 ssh -vvv
2. 没太看懂你的步骤,是所有机器都可以用证书登陆成功,还是只有部分机器才能用证书登陆成功?
3. 是部分机器用密码可以登陆成功,还是所有机器都无法用密码登陆成功?
dier
2021-06-04 17:14:42 +08:00
1 、看一下尝试用密码登录的那台机器上是不是有正确密钥;
2 、看一下被登录的机器里~/.ssh/known_hosts 文件里是不是有尝试用密码登录的这个机器的信息,删除试一下
toaruScar
2021-06-04 20:40:38 +08:00
你开了连接复用 auto-mux,“使用密钥成功能登陆”的那次不是因为用了密钥登陆,而是因为已经有一个 session 了而已
qping
2021-06-07 09:43:38 +08:00
qping
2021-06-07 09:43:55 +08:00
感谢,已经好了
dier
2021-06-07 09:46:28 +08:00
@qping 是怎么解决的?建议分享一下解决思路,如果以后有人遇到类似的问题找到这个帖子也许会有帮助
qping
2021-06-07 09:51:22 +08:00
@dier #6 已经 append 了,我这边 ssh 的服务器,中间可能有几层网关、防火墙。 上周出问题的 ip 映射了两台服务器。

这是一个专为移动设备优化的页面(即为了让你能够在 Google 搜索结果里秒开这个页面),如果你希望参与 V2EX 社区的讨论,你可以继续到 V2EX 上打开本讨论主题的完整版本。

https://www.v2ex.com/t/781412

V2EX 是创意工作者们的社区,是一个分享自己正在做的有趣事物、交流想法,可以遇见新朋友甚至新机会的地方。

V2EX is a community of developers, designers and creative people.

© 2021 V2EX